summaryrefslogtreecommitdiffstats
path: root/drivers/char/ipmi
Commit message (Collapse)AuthorAgeFilesLines
...
* ipmi: Fix some counter issuesCorey Minyard2018-04-181-31/+45
| | | | | | | | Counters would not be pegged properly on some errors. Have deliver_response() return an error so the counters can be incremented properly. Signed-off-by: Corey Minyard <cminyard@mvista.com>
* ipmi: Change ipmi_smi_t to struct ipmi_smi *Corey Minyard2018-04-183-95/+99
| | | | | | | Get rid of this coding style violation in the user files. Include files will come later. Signed-off-by: Corey Minyard <cminyard@mvista.com>
* ipmi: Rename ipmi_user_t to struct ipmi_user *Corey Minyard2018-04-184-47/+47
| | | | | | | Get rid of that non-compliance in the user files. Include files will come later. Signed-off-by: Corey Minyard <cminyard@mvista.com>
* ipmi_devintf: Small lock reworkCorey Minyard2018-04-181-55/+28
| | | | | | | | | | | | | The mutex didn't really serve any useful purpose, from what I can tell, and it would just get in the way. So remove it. Removing that required a mutex around the default value setting and getting, so just use the receive mutex for that. Also pull the fasync stuff outside of the lock for adding the data to the queue, since it didn't need to be there. Signed-off-by: Corey Minyard <cminyard@mvista.com>
* ipmi: Clean up some style issues in the message handlerCorey Minyard2018-04-181-48/+35
| | | | Signed-off-by: Corey Minyard <cminyard@mvista.com>
* ipmi: Break up i_ipmi_requestCorey Minyard2018-04-181-310/+344
| | | | | | It was huge, and easily broken into pieces. Signed-off-by: Corey Minyard <cminyard@mvista.com>
* ipmi:devintf: Clean up some coding style issuesCorey Minyard2018-04-181-22/+18
| | | | Signed-off-by: Corey Minyard <cminyard@mvista.com>
* ipmi: Clean up some debug codeCorey Minyard2018-04-181-33/+25
| | | | | | Replace ifdefs in the code with a simple function. Signed-off-by: Corey Minyard <cminyard@mvista.com>
* ipmi:watchdog: Use the IPMI panic handler instead of the system oneCorey Minyard2018-04-181-37/+23
| | | | | | | This is a cleaner interface and the main IPMI panic handler does setup required by the watchdog handler. Signed-off-by: Corey Minyard <cminyard@mvista.com>
* ipmi: Add a panic handler for IPMI usersCorey Minyard2018-04-181-110/+104
| | | | | | | | | | | | | | Users of the IPMI code had their own panic handlers, but the order was not necessarily right, the base IPMI code would need to handle the panic first, and the user had no way to know if the IPMI interface could run at panic time. Add a panic handler to the user interface, it is called if non-NULL and the interface the user is on is capable of panic handling. It also cleans up the panic log handling a bit to reuse the existing interface loop in the main panic handler. Signed-off-by: Corey Minyard <cminyard@mvista.com>
* ipmi:watchdog: Replace printk() with pr_xxx()Corey Minyard2018-04-181-30/+20
| | | | | | And clean broken strings. Signed-off-by: Corey Minyard <cminyard@mvista.com>
* ipmi:watchdog: Rework locking and handlingCorey Minyard2018-04-181-155/+140
| | | | | | | | | | | | | Simplify things by creating one set of message handling data for setting the watchdog and doing a heartbeat. Rework the locking to avoid some (probably not very important) races and to avoid a fairly unlikely infinite recursion. Get rid of ipmi_ignore_heartbeat, it wasn't used, and use watchdog_user to tell if we have a working IPMI device below us. Signed-off-by: Corey Minyard <cminyard@mvista.com>
* ipmi: Add a maintenance mode for IPMB messagesCorey Minyard2018-04-181-0/+28
| | | | | | | If you send a command to another BMC that might take some extra time, increase the timeouts temporarily. Signed-off-by: Corey Minyard <cminyard@mvista.com>
* ipmi: Add a way to tune some timeoutsCorey Minyard2018-04-181-32/+48
| | | | | | | | | | | | | | | | | | By default the retry timeout is 1 second. Allow that to be modified, primarily for slow operations, like firmware writes. Also, the timeout was driven by a 1 second timer, so 1 second really meant between 0 and 1 second. Set the default to 2 seconds so it means between 1 and 2 seconds. Also allow the time the interface automatically stays in mainenance mode to be modified from it's default 30 seconds. Also consolidate some of the timeout and retry setup. Signed-off-by: Corey Minyard <cminyard@mvista.com> more
* ipmi/parisc: Add IPMI chassis poweroff for certain HP PA-RISC and IA-64 serversHelge Deller2018-03-271-0/+21
| | | | | | | | | | | | | This patch allows HP PA-RISC servers like rp3410/rp3440 and the HP C8000 workstation with an IPMI controller that predate IPMI 1.5 to use the standard poweroff or powercycle commands. These systems firmware don't set the chassis capability bit in the Get Device ID, but they do implement the standard poweroff and powercycle commands. Signed-off-by: Helge Deller <deller@gmx.de> Signed-off-by: Corey Minyard <cminyard@mvista.com>
* ipmi_ssif: Fix kernel panic at msg_done_handlerKamlakant Patel2018-03-131-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | This happens when BMC doesn't return any data and the code is trying to print the value of data[2]. Getting following crash: [ 484.728410] Unable to handle kernel NULL pointer dereference at virtual address 00000002 [ 484.736496] pgd = ffff0000094a2000 [ 484.739885] [00000002] *pgd=00000047fcffe003, *pud=00000047fcffd003, *pmd=0000000000000000 [ 484.748158] Internal error: Oops: 96000005 [#1] SMP [...] [ 485.101451] Call trace: [...] [ 485.188473] [<ffff000000a46e68>] msg_done_handler+0x668/0x700 [ipmi_ssif] [ 485.195249] [<ffff000000a456b8>] ipmi_ssif_thread+0x110/0x128 [ipmi_ssif] [ 485.202038] [<ffff0000080f1430>] kthread+0x108/0x138 [ 485.206994] [<ffff0000080838e0>] ret_from_fork+0x10/0x30 [ 485.212294] Code: aa1903e1 aa1803e0 b900227f 95fef6a5 (39400aa3) Adding a check to validate the data len before printing data[2] to fix this issue. Signed-off-by: Kamlakant Patel <kamlakant.patel@cavium.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
* ipmi:pci: Blacklist a Realtek "IPMI" deviceCorey Minyard2018-03-131-0/+12
| | | | | | | | | Realtek has some sort of "Virtual" IPMI device on the PCI bus as a KCS controller, but whatever it is, it's not one. Ignore it if seen. Reported-by: Chris Chiu <chiu@endlessm.com> Signed-off-by: Corey Minyard <cminyard@mvista.com> Tested-by: Daniel Drake <drake@endlessm.com>
* ipmi: Remove ACPI SPMI probing from the system interface driverCorey Minyard2018-03-121-154/+0
| | | | | | | | | | | | | | | | The IPMI spec states: The purpose of the SPMI Table is to provide a mechanism that can be used by the OSPM (an ACPI term for “OS Operating System-directed configuration and Power Management” essentially meaning an ACPI-aware OS or OS loader) very early in the boot process, e.g., before the ability to execute ACPI control methods in the OS is available. When we are probing IPMI in Linux, ACPI control methods are available, so we shouldn't be probing using SPMI. It could cause some confusion during the probing process. Signed-off-by: Corey Minyard <cminyard@mvista.com>
* ipmi: Remove ACPI SPMI probing from the SSIF (I2C) driverCorey Minyard2018-03-121-105/+0
| | | | | | | | | | | | | | | | | The IPMI spec states: The purpose of the SPMI Table is to provide a mechanism that can be used by the OSPM (an ACPI term for “OS Operating System-directed configuration and Power Management” essentially meaning an ACPI-aware OS or OS loader) very early in the boot process, e.g., before the ability to execute ACPI control methods in the OS is available. When we are probing IPMI in Linux, ACPI control methods are available, so we shouldn't be probing using SPMI. It could cause some confusion during the probing process. Signed-off-by: Corey Minyard <cminyard@mvista.com> Tested-by: Jiandi An <anjiandi@codeaurora.org>
* ipmi: missing error code in try_smi_init()Dan Carpenter2018-03-061-0/+1
| | | | | | | | If platform_device_alloc() then we should return -ENOMEM instead of returning success. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
* ipmi: use ARRAY_SIZE for poweroff_functions array sizing calculationColin Ian King2018-03-061-2/+1
| | | | | | | | Use the ARRAY_SIZE macro on a array poweroff_functions to determine size of the array. Improvement suggested by Coccinelle. Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
* ipmi: Consolidate cleanup codeCorey Minyard2018-03-061-94/+70
| | | | | | | The cleanup code for an init failure and for a device removal were quite similar, consolidate all that into one function. Signed-off-by: Corey Minyard <cminyard@mvista.com>
* ipmi: Remove some unnecessary initializationsCorey Minyard2018-03-061-5/+0
| | | | | | The data is allocated with kzalloc, no need to set things to NULL. Signed-off-by: Corey Minyard <cminyard@mvista.com>
* ipmi: Fix some error cleanup issuesCorey Minyard2018-03-061-4/+14
| | | | | | | | | | | | | device_remove_group() was called on any cleanup, even if the device attrs had not been added yet. That can occur in certain error scenarios, so add a flag to know if it has been added. Also make sure we remove the dev if we added it ourselves. Signed-off-by: Corey Minyard <cminyard@mvista.com> Cc: stable@vger.kernel.org # 4.15 Cc: Laura Abbott <labbott@redhat.com> Tested-by: Bill Perkins <wmp@grnwood.net>
* ipmi: Add or fix SPDX-License-Identifier in all filesCorey Minyard2018-02-2722-206/+24
| | | | | | | | | | | And get rid of the license text that is no longer necessary. Signed-off-by: Corey Minyard <cminyard@mvista.com> Cc: Kees Cook <keescook@chromium.org> Cc: Alistair Popple <alistair@popple.id.au> Cc: Jeremy Kerr <jk@ozlabs.org> Cc: Joel Stanley <joel@jms.id.au> Cc: Rocky Craig <rocky.craig@hp.com>
* ipmi: Re-use existing macros for built-in propertiesAndy Shevchenko2018-02-261-13/+5
| | | | | | | | | Replace home grown set_prop_entry() macro by generic PROPERTY_ENTRY_INTEGER()-like ones. Cc: Corey Minyard <cminyard@mvista.com> Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
* ipmi:pci: Make the PCI defines consistent with normal Linux onesCorey Minyard2018-02-261-17/+14
| | | | Signed-off-by: Corey Minyard <cminyard@mvista.com>
* ipmi: kcs_bmc: coding-style fixes and use new poll typeHaiyue Wang2018-02-263-36/+41
| | | | | | | | Many for coding-style fixes, and update the poll API with the new type '__poll_t', this is new commit from linux-4.16-rc1. Signed-off-by: Haiyue Wang <haiyue.wang@linux.intel.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
* ipmi: kcs_bmc: mark expected switch fall-through in kcs_bmc_handle_dataGustavo A. R. Silva2018-02-261-0/+1
| | | | | | | | | | In preparation to enabling -Wimplicit-fallthrough, mark switch cases where we are expecting to fall through. Addresses-Coverity-ID: 1465255 ("Missing break in switch") Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com> Cc: Haiyue Wang <haiyue.wang@linux.intel.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
* ipmi: add an Aspeed KCS IPMI BMC driverHaiyue Wang2018-02-263-0/+332
| | | | | | | | | | | | | The KCS (Keyboard Controller Style) interface is used to perform in-band IPMI communication between a server host and its BMC (BaseBoard Management Controllers). This driver exposes the KCS interface on ASpeed SOCs (AST2400 and AST2500) as a character device. Such SOCs are commonly used as BMCs and this driver implements the BMC side of the KCS interface. Signed-off-by: Haiyue Wang <haiyue.wang@linux.intel.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
* ipmi: add a KCS IPMI BMC driverHaiyue Wang2018-02-264-0/+574
| | | | | | | | | | | | Provides a device driver for the KCS (Keyboard Controller Style) IPMI interface which meets the requirement of the BMC (Baseboard Management Controllers) side for handling the IPMI request from host system software. Signed-off-by: Haiyue Wang <haiyue.wang@linux.intel.com> [Removed the selectability of IPMI_KCS_BMC, as it doesn't do much good to have it by itself.] Signed-off-by: Corey Minyard <cminyard@mvista.com>
* vfs: do bulk POLL* -> EPOLL* replacementLinus Torvalds2018-02-113-4/+4
| | | | | | | | | | | | | | | | | | | | | | | This is the mindless scripted replacement of kernel use of POLL* variables as described by Al, done by this script: for V in IN OUT PRI ERR RDNORM RDBAND WRNORM WRBAND HUP RDHUP NVAL MSG; do L=`git grep -l -w POLL$V | grep -v '^t' | grep -v /um/ | grep -v '^sa' | grep -v '/poll.h$'|grep -v '^D'` for f in $L; do sed -i "-es/^\([^\"]*\)\(\<POLL$V\>\)/\\1E\\2/" $f; done done with de-mangling cleanups yet to come. NOTE! On almost all architectures, the EPOLL* constants have the same values as the POLL* constants do. But they keyword here is "almost". For various bad reasons they aren't the same, and epoll() doesn't actually work quite correctly in some cases due to this on Sparc et al. The next patch from Al will sort out the final differences, and we should be all done. Scripted-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* Merge tag 'driver-core-4.16-rc1' of ↵Linus Torvalds2018-02-011-9/+8
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core Pull driver core updates from Greg KH: "Here is the set of "big" driver core patches for 4.16-rc1. The majority of the work here is in the firmware subsystem, with reworks to try to attempt to make the code easier to handle in the long run, but no functional change. There's also some tree-wide sysfs attribute fixups with lots of acks from the various subsystem maintainers, as well as a handful of other normal fixes and changes. And finally, some license cleanups for the driver core and sysfs code. All have been in linux-next for a while with no reported issues" * tag 'driver-core-4.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: (48 commits) device property: Define type of PROPERTY_ENRTY_*() macros device property: Reuse property_entry_free_data() device property: Move property_entry_free_data() upper firmware: Fix up docs referring to FIRMWARE_IN_KERNEL firmware: Drop FIRMWARE_IN_KERNEL Kconfig option USB: serial: keyspan: Drop firmware Kconfig options sysfs: remove DEBUG defines sysfs: use SPDX identifiers drivers: base: add coredump driver ops sysfs: add attribute specification for /sysfs/devices/.../coredump test_firmware: fix missing unlock on error in config_num_requests_store() test_firmware: make local symbol test_fw_config static sysfs: turn WARN() into pr_warn() firmware: Fix a typo in fallback-mechanisms.rst treewide: Use DEVICE_ATTR_WO treewide: Use DEVICE_ATTR_RO treewide: Use DEVICE_ATTR_RW sysfs.h: Use octal permissions component: add debugfs support bus: simple-pm-bus: convert bool SIMPLE_PM_BUS to tristate ...
| * treewide: Use DEVICE_ATTR_ROJoe Perches2018-01-091-9/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Convert DEVICE_ATTR uses to DEVICE_ATTR_RO where possible. Done with perl script: $ git grep -w --name-only DEVICE_ATTR | \ xargs perl -i -e 'local $/; while (<>) { s/\bDEVICE_ATTR\s*\(\s*(\w+)\s*,\s*\(?(?:\s*S_IRUGO\s*|\s*0444\s*)\)?\s*,\s*\1_show\s*,\s*NULL\s*\)/DEVICE_ATTR_RO(\1)/g; print;}' Signed-off-by: Joe Perches <joe@perches.com> Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Acked-by: Robert Jarzmik <robert.jarzmik@free.fr> Acked-by: Sagi Grimberg <sagi@grimberg.me> Acked-by: Zhang Rui <rui.zhang@intel.com> Acked-by: Harald Freudenberger <freude@linux.vnet.ibm.com> Acked-by: Jani Nikula <jani.nikula@intel.com> Acked-by: Corey Minyard <cminyard@mvista.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | Merge tag 'for-linus-4.16-1' of git://github.com/cminyard/linux-ipmiLinus Torvalds2018-01-317-14/+21
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Pull IPMI updates from Corey Minyard: "Small fixes for various things, been sitting in next for a while (some a long time)" * tag 'for-linus-4.16-1' of git://github.com/cminyard/linux-ipmi: ipmi_ssif: Remove duplicate NULL check ipmi/powernv: Fix error return code in ipmi_powernv_probe() ipmi: use dynamic memory for DMI driver override ipmi/ipmi_powernv: remove outdated todo in powernv IPMI driver ipmi: Clear smi_info->thread to prevent use-after-free during module unload ipmi: use correct string length ipmi_si: Fix error handling of platform device ipmi watchdog: fix typo in parameter description ipmi_si_platform: Fix typo in parameter description
| * | ipmi_ssif: Remove duplicate NULL checkAndy Shevchenko2018-01-221-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since i2c_unregister_device() became NULL-aware we may remove duplicate NULL check. Cc: Corey Minyard <minyard@acm.org> Cc: openipmi-developer@lists.sourceforge.net Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
| * | ipmi/powernv: Fix error return code in ipmi_powernv_probe()Wei Yongjun2018-01-221-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix to return a negative error code from the request_irq() error handling case instead of 0, as done elsewhere in this function. Fixes: dce143c3381c ("ipmi/powernv: Convert to irq event interface") Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com> Reviewed-by: Alexey Kardashevskiy <aik@ozlabs.ru> Signed-off-by: Corey Minyard <cminyard@mvista.com>
| * | ipmi: use dynamic memory for DMI driver overrideJohn Garry2018-01-221-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently a crash can be seen if we reach the "err" label in dmi_add_platform_ipmi(), calling platform_device_put(), like here: [ 7.270584] (null): ipmi:dmi: Unable to add resources: -16 [ 7.330229] ------------[ cut here ]------------ [ 7.334889] kernel BUG at mm/slub.c:3894! [ 7.338936] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP [ 7.344475] Modules linked in: [ 7.347556] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 4.15.0-rc2-00004-gbe9cb7b-dirty #114 [ 7.355907] Hardware name: Huawei Taishan 2280 /D05, BIOS Hisilicon D05 IT17 Nemo 2.0 RC0 11/29/2017 [ 7.365137] task: 00000000c211f6d3 task.stack: 00000000f276e9af [ 7.371116] pstate: 60000005 (nZCv daif -PAN -UAO) [ 7.375957] pc : kfree+0x194/0x1b4 [ 7.379389] lr : platform_device_release+0xcc/0xd8 [ 7.384225] sp : ffff0000092dba90 [ 7.387567] x29: ffff0000092dba90 x28: ffff000008a83000 [ 7.392933] x27: ffff0000092dbc10 x26: 00000000000000e6 [ 7.398297] x25: 0000000000000003 x24: ffff0000085b51e8 [ 7.403662] x23: 0000000000000100 x22: ffff7e0000234cc0 [ 7.409027] x21: ffff000008af3660 x20: ffff8017d21acc10 [ 7.414392] x19: ffff8017d21acc00 x18: 0000000000000002 [ 7.419757] x17: 0000000000000001 x16: 0000000000000008 [ 7.425121] x15: 0000000000000001 x14: 6666666678303d65 [ 7.430486] x13: 6469727265766f5f x12: 7265766972642e76 [ 7.435850] x11: 6564703e2d617020 x10: 6530326435373638 [ 7.441215] x9 : 3030303030303030 x8 : 3d76656420657361 [ 7.446580] x7 : ffff000008f59df8 x6 : ffff8017fbe0ea50 [ 7.451945] x5 : 0000000000000000 x4 : 0000000000000000 [ 7.457309] x3 : ffffffffffffffff x2 : 0000000000000000 [ 7.462674] x1 : 0fffc00000000800 x0 : ffff7e0000234ce0 [ 7.468039] Process swapper/0 (pid: 1, stack limit = 0x00000000f276e9af) [ 7.474809] Call trace: [ 7.477272] kfree+0x194/0x1b4 [ 7.480351] platform_device_release+0xcc/0xd8 [ 7.484837] device_release+0x34/0x90 [ 7.488531] kobject_put+0x70/0xcc [ 7.491961] put_device+0x14/0x1c [ 7.495304] platform_device_put+0x14/0x1c [ 7.499439] dmi_add_platform_ipmi+0x348/0x3ac [ 7.503923] scan_for_dmi_ipmi+0xfc/0x10c [ 7.507970] do_one_initcall+0x38/0x124 [ 7.511840] kernel_init_freeable+0x188/0x228 [ 7.516238] kernel_init+0x10/0x100 [ 7.519756] ret_from_fork+0x10/0x18 [ 7.523362] Code: f94002c0 37780080 f94012c0 37000040 (d4210000) [ 7.529552] ---[ end trace 11750e4787deef9e ]--- [ 7.534228] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b [ 7.534228] This is because when the device is released in platform_device_release(), we try to free pdev.driver_override. This is a const string, hence the crash. Fix by using dynamic memory for pdev->driver_override. Signed-off-by: John Garry <john.garry@huawei.com> [Removed the free of driver_override from ipmi_si_remove_by_dev(). The free is done in platform_device_release(), and would result in a double free, and ipmi_si_remove_by_dev() is called by non-platform devices.] Signed-off-by: Corey Minyard <cminyard@mvista.com> Cc: <stable@vger.kernel.org> # 4.14+
| * | ipmi/ipmi_powernv: remove outdated todo in powernv IPMI driverJeremy Kerr2018-01-161-1/+0
| | | | | | | | | | | | | | | | | | | | | | | | Since the IPMI core now queries device IDs dynamically, we no longer need this todo for implementing this in the powernv driver. Signed-off-by: Jeremy Kerr <jk@ozlabs.org> Signed-off-by: Corey Minyard <cminyard@mvista.com>
| * | ipmi: Clear smi_info->thread to prevent use-after-free during module unloadMasamitsu Yamazaki2018-01-151-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | During code inspection, I found an use-after-free possibility during unloading ipmi_si in the polling mode. If start_new_msg() is called after kthread_stop(), the function will try to wake up non-existing kthread using the dangling pointer. Possible scenario is when a new internal message is generated after ipmi_unregister_smi()[*1] and remains after stop_timer_and_thread() in clenaup_one_si() [*2]. Use-after-free could occur as follows depending on BMC replies. cleanup_one_si => ipmi_unregister_smi [*1] => stop_timer_and_thread => kthread_stop(smi_info->thread) [*2] => poll => smi_event_handler => start_new_msg => if (smi_info->thread) wake_up_process(smi_info->thread) <== use-after-free!! Although currently it seems no such message is generated in the polling mode, some changes might introduce that in thefuture. For example in the interrupt mode, disable_si_irq() does that at [*2]. So let's prevent such a critical issue possibility now. Signed-off-by: Yamazaki Masamitsu <m-yamazaki@ah.jp.nec.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
| * | ipmi: use correct string lengthXiongfeng Wang2018-01-082-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | gcc-8 reports drivers/char/ipmi/ipmi_msghandler.c: In function 'panic_op_write_handler': ./include/linux/string.h:245:9: warning: '__builtin_strncpy' specified bound 16 equals destination size [-Wstringop-truncation] drivers/char/ipmi/ipmi_watchdog.c: In function 'set_param_str': ./include/linux/string.h:245:9: warning: '__builtin_strncpy' specified bound 16 equals destination size [-Wstringop-truncation] We need one less byte or call strlcpy() to make it a nul-terminated string. Signed-off-by: Xiongfeng Wang <xiongfeng.wang@linaro.org> Signed-off-by: Corey Minyard <cminyard@mvista.com>
| * | ipmi_si: Fix error handling of platform deviceCorey Minyard2017-12-121-3/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Cleanup of platform devices created by the IPMI driver was not being done correctly and could result in a memory leak. So create a local boolean to know how to clean up those platform devices. Reported-by: David Binderman <dcb314@hotmail.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
| * | ipmi watchdog: fix typo in parameter descriptionWei Yongjun2017-12-121-1/+1
| | | | | | | | | | | | | | | | | | | | | Fix typo in parameter description. Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
| * | ipmi_si_platform: Fix typo in parameter descriptionWei Yongjun2017-12-121-1/+1
| |/ | | | | | | | | | | | | | | Fix typo in parameter description. Fixes: 95e300c052fd ("ipmi: Make the DMI probe into a generic platform probe") Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
* | Merge branch 'misc.poll' of ↵Linus Torvalds2018-01-303-6/+6
|\ \ | |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull poll annotations from Al Viro: "This introduces a __bitwise type for POLL### bitmap, and propagates the annotations through the tree. Most of that stuff is as simple as 'make ->poll() instances return __poll_t and do the same to local variables used to hold the future return value'. Some of the obvious brainos found in process are fixed (e.g. POLLIN misspelled as POLL_IN). At that point the amount of sparse warnings is low and most of them are for genuine bugs - e.g. ->poll() instance deciding to return -EINVAL instead of a bitmap. I hadn't touched those in this series - it's large enough as it is. Another problem it has caught was eventpoll() ABI mess; select.c and eventpoll.c assumed that corresponding POLL### and EPOLL### were equal. That's true for some, but not all of them - EPOLL### are arch-independent, but POLL### are not. The last commit in this series separates userland POLL### values from the (now arch-independent) kernel-side ones, converting between them in the few places where they are copied to/from userland. AFAICS, this is the least disruptive fix preserving poll(2) ABI and making epoll() work on all architectures. As it is, it's simply broken on sparc - try to give it EPOLLWRNORM and it will trigger only on what would've triggered EPOLLWRBAND on other architectures. EPOLLWRBAND and EPOLLRDHUP, OTOH, are never triggered at all on sparc. With this patch they should work consistently on all architectures" * 'misc.poll' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (37 commits) make kernel-side POLL... arch-independent eventpoll: no need to mask the result of epi_item_poll() again eventpoll: constify struct epoll_event pointers debugging printk in sg_poll() uses %x to print POLL... bitmap annotate poll(2) guts 9p: untangle ->poll() mess ->si_band gets POLL... bitmap stored into a user-visible long field ring_buffer_poll_wait() return value used as return value of ->poll() the rest of drivers/*: annotate ->poll() instances media: annotate ->poll() instances fs: annotate ->poll() instances ipc, kernel, mm: annotate ->poll() instances net: annotate ->poll() instances apparmor: annotate ->poll() instances tomoyo: annotate ->poll() instances sound: annotate ->poll() instances acpi: annotate ->poll() instances crypto: annotate ->poll() instances block: annotate ->poll() instances x86: annotate ->poll() instances ...
| * the rest of drivers/*: annotate ->poll() instancesAl Viro2017-11-283-6/+6
| | | | | | | | Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* | Merge tag 'for-linus-4.15-2' of git://github.com/cminyard/linux-ipmiLinus Torvalds2017-12-113-23/+30
|\ \ | |/ |/| | | | | | | | | | | | | Pull IPMI fixes from Corey Minyard. * tag 'for-linus-4.15-2' of git://github.com/cminyard/linux-ipmi: ipmi_si: fix crash on parisc ipmi_si: Fix oops with PCI devices ipmi: Stop timers before cleaning up the module
| * ipmi_si: fix crash on pariscMikulas Patocka2017-12-111-0/+2
| | | | | | | | | | | | | | | | | | This patch fixes ipmi crash on parisc introduced in the kernel 4.15-rc. The pointer io.io_setup is not initialized and thus it causes crash in try_smi_init when attempting to call new_smi->io.io_setup. Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
| * ipmi_si: Fix oops with PCI devicesCorey Minyard2017-12-111-2/+5
| | | | | | | | | | | | | | | | | | | | | | When the IPMI PCI code was split out, some code was consolidated for setting the io_setup field in the io structure. The PCI code needed this set before registration to probe register spacing, though, so restore the old code for that function. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=197999 Signed-off-by: Corey Minyard <cminyard@mvista.com> Tested-by: Meelis Roos <mroos@linux.ee>
| * ipmi: Stop timers before cleaning up the moduleMasamitsu Yamazaki2017-12-061-21/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | System may crash after unloading ipmi_si.ko module because a timer may remain and fire after the module cleaned up resources. cleanup_one_si() contains the following processing. /* * Make sure that interrupts, the timer and the thread are * stopped and will not run again. */ if (to_clean->irq_cleanup) to_clean->irq_cleanup(to_clean); wait_for_timer_and_thread(to_clean); /* * Timeouts are stopped, now make sure the interrupts are off * in the BMC. Note that timers and CPU interrupts are off, * so no need for locks. */ while (to_clean->curr_msg || (to_clean->si_state != SI_NORMAL)) { poll(to_clean); schedule_timeout_uninterruptible(1); } si_state changes as following in the while loop calling poll(to_clean). SI_GETTING_MESSAGES => SI_CHECKING_ENABLES => SI_SETTING_ENABLES => SI_GETTING_EVENTS => SI_NORMAL As written in the code comments above, timers are expected to stop before the polling loop and not to run again. But the timer is set again in the following process when si_state becomes SI_SETTING_ENABLES. => poll => smi_event_handler => handle_transaction_done // smi_info->si_state == SI_SETTING_ENABLES => start_getting_events => start_new_msg => smi_mod_timer => mod_timer As a result, before the timer set in start_new_msg() expires, the polling loop may see si_state becoming SI_NORMAL and the module clean-up finishes. For example, hard LOCKUP and panic occurred as following. smi_timeout was called after smi_event_handler, kcs_event and hangs at port_inb() trying to access I/O port after release. [exception RIP: port_inb+19] RIP: ffffffffc0473053 RSP: ffff88069fdc3d80 RFLAGS: 00000006 RAX: ffff8806800f8e00 RBX: ffff880682bd9400 RCX: 0000000000000000 RDX: 0000000000000ca3 RSI: 0000000000000ca3 RDI: ffff8806800f8e40 RBP: ffff88069fdc3d80 R8: ffffffff81d86dfc R9: ffffffff81e36426 R10: 00000000000509f0 R11: 0000000000100000 R12: 0000000000]:000000 R13: 0000000000000000 R14: 0000000000000246 R15: ffff8806800f8e00 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0000 --- <NMI exception stack> --- To fix the problem I defined a flag, timer_can_start, as member of struct smi_info. The flag is enabled immediately after initializing the timer and disabled immediately before waiting for timer deletion. Fixes: 0cfec916e86d ("ipmi: Start the timer and thread on internal msgs") Signed-off-by: Yamazaki Masamitsu <m-yamazaki@ah.jp.nec.com> [Adjusted for recent changes in the driver.] Signed-off-by: Corey Minyard <cminyard@mvista.com>
OpenPOWER on IntegriCloud